The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is shared between RSCI     and all other SCIF port types, but the RSCI overrun_reg is specified as a memory offset, while for other     SCIF types it is an enum value used to index into the sci_port_params->regs array, as mentioned above the     sci_serial_in() function. For RSCI, the overrun_reg is CSR (0x48), causing the sci_getreg() call inside     the sci_handle_fifo_overrun() function to index outside the bounds of the regs array, which currently has     a size of 20, as specified by SCI_NR_REGS. Because of this, we end up accessing memory outside of RSCI's     rsci_port_params structure, which, when interpreted as a plat_sci_reg, happens to have a non-zero size,     causing the following WARN when sci_serial_in() is called, as the accidental size does not match the     supported register sizes. The existence of the overrun_reg needs to be checked because     SCIx_SH3_SCIF_REGTYPE has overrun_reg set to SCLSR, but SCLSR is not present in the regs array. Avoid     calling sci_getreg() for port types which don't use standard register handling. Use the ops->read_reg()     and ops->write_reg() functions to properly read and write registers for RSCI, and change the type of the     status variable to accommodate the 32-bit CSR register. sci_getreg() and sci_serial_in() are also called     with overrun_reg in the sci_mpxed_interrupt() interrupt handler, but that code path is not used for RSCI,     as it does not have a muxed interrupt. ------------[ cut here ]------------ Invalid register access     WARNING: CPU: 0 PID: 0 at drivers/tty/serial/sh-sci.c:522 sci_serial_in+0x38/0xac Modules linked in:
    renesas_usbhs at24 rzt2h_adc industrialio_adc sha256 cfg80211 bluetooth ecdh_generic ecc rfkill fuse drm     backlight ipv6 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.17.0-rc1+ #30 PREEMPT Hardware name:
    Renesas RZ/T2H EVK Board based on r9a09g077m44 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS     BTYPE=--) pc : sci_serial_in+0x38/0xac lr : sci_serial_in+0x38/0xac sp : ffff800080003e80 x29:
    ffff800080003e80 x28: ffff800082195b80 x27: 000000000000000d x26: ffff8000821956d0 x25: 0000000000000000     x24: ffff800082195b80 x23: ffff000180e0d800 x22: 0000000000000010 x21: 0000000000000000 x20:
    0000000000000010 x19: ffff000180e72000 x18: 000000000000000a x17: ffff8002bcee7000 x16: ffff800080000000     x15: 0720072007200720 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11:
    0000000000000058 x10: 0000000000000018 x9 : ffff8000821a6a48 x8 : 0000000000057fa8 x7 : 0000000000000406     x6 : ffff8000821fea48 x5 : ffff00033ef88408 x4 : ffff8002bcee7000 x3 : ffff800082195b80 x2 :
    0000000000000000 x1 : 0000000000000000 x0 : ffff800082195b80 Call trace: sci_serial_in+0x38/0xac (P)     sci_handle_fifo_overrun.isra.0+0x70/0x134 sci_er_interrupt+0x50/0x39c __handle_irq_event_percpu+0x48/0x140     handle_irq_event+0x44/0xb0 handle_fasteoi_irq+0xf4/0x1a0 handle_irq_desc+0x34/0x58     generic_handle_domain_irq+0x1c/0x28 gic_handle_irq+0x4c/0x140 call_on_irq_stack+0x30/0x48     do_interrupt_handler+0x80/0x84 el1_interrupt+0x34/0x68 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70     default_idle_call+0x28/0x58 (P) do_idle+0x1f8/0x250 cpu_startup_entry+0x34/0x3c rest_init+0xd8/0xe0     console_on_rootfs+0x0/0x6c __primary_switched+0x88/0x90 ---[ end trace 0000000000000000 ]---     (CVE-2025-40222)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40222

high Nessus Plugin ID 277687

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.7 Feb 13, 2026, 5:22 AM Detection (updated detection logic) Plugin Feed: 202602130522
Version 1.6 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.5 Jan 31, 2026, 11:07 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.4 Jan 21, 2026, 5:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601211700
Version 1.3 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin Feed: 202601101958
Version 1.2 Dec 15, 2025, 9:39 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.1 Dec 9, 2025, 2:31 AM New Plugin Feed: 202512090231